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SUBJECT:  Audit  Report  on  Year  2000  Compliance  of  the  Worldwide  Port  System 
(Report  No.  99-190) 


We  are  providing  this  report  for  your  information  and  use.  This  report  is  one  in  a 
series  being  issued  by  the  Inspector  General,  DoD,  in  accordance  with  an  informal 
partnership  with  the  Chief  Information  Officer,  DoD,  to  monitor  efforts  to  address  the 
year  2000  computing  challenge.  Because  this  report  contains  no  recommendations,  no 
written  comments  were  required,  and  none  were  received  Therefore,  we  are  publishing 
this  report  in  final  form. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Mr.  Robert  M,  Murrell  at  (703)  604-9210  (DSN  664-9210) 
(rmurrell@dodig.osd.mil)  or  Mr.  Joseph  M  Austin  at  (703)  604-9178  (DSN  664-9178) 
(jaustin@dodig.osd.mil)  See  Appendix  B  for  the  report  distribution  Audit  team 
members  are  listed  inside  the  back  cover. 
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for  Auditing 
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(Project  No.  9LH-5039.03) 

Year  2000  Compliance  of 
the  Worldwide  Port  System 


Executive  Summary 


Introduction.  This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  efforts  to  address  the  year  2000  (Y2K)  computing  challenge.  For  a  list 
of  audit  projects  addressing  the  issue,  see  the  Y2K  webpage  on  the  IGnet  at 
http://www.ignet.gov/ 

The  Worldwide  Port  System  (WPS)  is  a  mission-critical  automated  information  system 
designed  to  support  the  operational  requirements  of  DoD  for  tracking  and  documenting 
the  movement  of  DoD  ocean  cargo  through  water  ports  It  is  fielded  at  72  Army  and 
Navy  organizations  worldwide 

Objectives.  The  overall  audit  objective  was  to  evaluate  whether  DoD  was  adequately 
planning  for  and  managing  Y2K  risks  for  selected  logistics  systems  to  avoid  disruption  of 
the  DoD  mission.  Specifically,  we  reviewed  the  Y2K  risk  assessments,  testing,  and 
contingency  planning  for  selected  logistics  systems  that  support  the  DoD  mission  For 
this  report,  we  reviewed  the  WPS. 

Results.  WPS  had  a  low  risk  of  failure  associated  with  Y2K  processing.  The  WPS 
program  manager  implemented  a  certification  process  that  verified  and  certified  WPS  in 
accordance  with  DoD  and  Army  Y2K  guidance.  The  program  manager  documented  test 
plans  and  test  results,  established  interface  agreements  for  systems  with  which  WPS 
interfaced,  and  prepared  contingency  plans  before  system  certification.  Furthermore,  a 
contracted  independent  assessment  concluded  that  WPS  faces  a  low  risk  of  Y2K-related 
disruptions.  As  a  result,  WPS  should  be  able  to  support  operational  requirements  for 
tracking  and  documenting  the  movement  of  DoD  ocean-bound  cargo  through  water  ports 
in  a  Y2K  environment 

Management  Comments.  We  provided  a  draft  of  this  report  on  May  6,  1999.  Because 
this  report  contains  no  recommendations,  written  comments  were  not  required,  and  none 
were  received.  Therefore,  we  are  publishing  this  report  in  final  form 
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Background 


This  report  is  one  in  a  series  of  reports  resulting  from  our  audits  of  selected 
logistics  systems  that  support  the  DoD  mission.  This  report  discusses  year  2000 
(Y2K)  issues  for  the  Worldwide  Port  System  (WPS). 

Executive  Order.  The  Executive  Order,  “Year  2000  Conversion,”  February  4, 
1998,  mandates  that  Federal  agencies  do  what  is  necessary  to  ensure  that  no 
critical  Federal  programs  experience  disruption  because  of  the  year  2000 
computing  problem.  The  Executive  Order  requires  that  the  head  of  each  agency 
ensure  that  efforts  to  address  Y2K  issues  receive  the  highest  priority  in  the 
agency. 

DoD  Y2K  Management  Plan.  The  “DoD  Year  2000  Management  Plan,” 

(DoD  Management  Plan)  version  2,  December  1998,  provides  guidance  for 
testing  and  certifying  systems  and  preparing  contingency  plans  for  those 
systems,  and  stipulates  the  criteria  that  DoD  Components  must  use  to  meet 
reporting  requirements. 

Army  Y2K  Action  Plan.  The  “Army  Year  2000  Action  Plan,”  (Army  Action 
Plan)  revision  II,  June  1998,  outlines  the  Army  Y2K  management  strategy; 
provides  guidance,  and  defines  roles,  responsibilities,  and  reporting  requirements 
The  plan  applies  to  all  systems  supported  by  information  technology,  their 
technical  environment,  and  their  communications  devices 

Military  Traffic  Management  Command.  The  U  S.  Military  Traffic 
Management  Command  (MTMC),  located  in  Falls  Church,  Virginia,  is  the 
surface  transportation  component  of  the  U.S.  Transportation  Command.  MTMC 
provides  management  control  over  international  surface  cargo  bookings  and  cargo 
movement,  ocean  carrier  contract  administration,  worldwide  water  terminal 
participation  in  field  training  exercises,  and  functional  requirements  for 
transportation  automated  systems  to  support  international  surface  cargo  operations 
and  management.  The  WPS  Program  Management  Office  is  responsible  for  all 
development  and  implementation  activities  associated  with  the  MTMC  automated 
cargo  traffic  management  information  system. 

Worldwide  Port  System.  WPS  is  a  mission-critical  automated  information 
system  designed  to  support  the  operational  requirements  of  DoD  for  tracking  and 
documenting  the  movement  of  DoD  ocean  cargo  through  water  ports.  It  is  fielded 
at  72  Army  and  Navy  organizations  worldwide. 

Objectives 


The  overall  audit  objective  was  to  evaluate  whether  DoD  was  adequately  planning 
for  and  managing  Y2K  risks  for  selected  logistics  systems  to  avoid  disruption  of 
the  DoD  mission.  Specifically,  we  reviewed  Y2K  risk  assessments,  testing,  and 
contingency  planning  for  selected  logistics  systems  that  support  the  DoD  mission 
For  this  report,  we  reviewed  the  WPS.  See  Appendix  A  for  a  discussion  of  the 
scope  and  methodology  and  for  a  summary  of  prior  coverage 


1 


Year  2000  Compliance  of  the  Worldwide 
Port  System 

WPS  had  a  low  risk  of  failure  associated  with  Y2K  processing.  The  WPS 
program  manager  implemented  a  certification  process  that  verified  and 
certified  WPS  in  accordance  with  DoD  and  Army  Y2K  guidance.  The 
program  manager  documented  test  plans  and  test  results,  established 
interface  agreements  for  systems  with  which  WPS  interfaced,  and 
prepared  contingency  plans  before  system  certification.  Furthermore,  a 
contracted  independent  assessment  concluded  that  WPS  faces  a  low  risk  of 
Y2K-related  disruptions.  As  a  result,  WPS  should  be  able  to  support 
operational  requirements  for  tracking  and  documenting  the  movement  of 
DoD  ocean-bound  cargo  through  water  ports  in  a  Y2K  environment 

Compliance  Milestone 


The  DoD  Management  Plan  provides  guidance  for  testing  and  certifying  systems 
and  preparing  contingency  plans  for  those  systems,  and  stipulates  the  criteria  that 
DoD  Components  must  use  to  meet  reporting  requirements 

MTMC  met  the  DoD  Management  Plan  milestone  of  December  31,  1998,  for 
completion  of  the  implementation  phase  for  mission-critical  systems  WPS  was 
certified  by  the  Army  Deputy  Chief  of  Staff  for  Logistics  (Director  of 
Transportation,  Energy  and  Troop  Support)  on  December  2,  1998 

Army  Certification  Process 

The  WPS  program  manager  followed  the  certification  process  outlined  in  the 
Army  Action  Plan.  WPS  certification  was  supported  by  documented  test  plans 
and  test  reports  and  by  compliance  checklists  and  matrixes  that  summarized  the 
results  of  Y2K  compliance  assessments  and  tests  Interface  agreements  and 
contingency  plans  also  supported  the  certification  process 

Testing  Y2K  Compliance.  From  September  14,  1998,  through  October  23, 

1998,  Lockheed  Martin  Support  Services,  under  contract  with  MTMC,  verified 
the  ability  of  WPS  to  successfully  process  data  containing  Y2K  dates  with  no 
adverse  affect  on  the  end  users.  Lockheed  Martin  Support  Services  created  test 
scenarios  that  reflected  actual  WPS  operations  and  ran  them  in  four  time  periods, 
with  data  used  in  and  maintained  from  one  phase  to  the  next  Specific  dates  tested 
included  dates  in  the  20th  and  21st  centuries,  dates  crossing  1999  and  2000,  and 
leap  year  dates.  Problems  noted  during  the  compliance  test  were  fixed  and 
regression  testing’  was  conducted.  Regression  testing  was  conducted  from 
October  26  through  October  30,  1998  The  testing  validated  that  problems 
associated  with  Y2K  issues  had  been  fixed. 

Interface  Agreements.  The  WPS  Program  Management  Office  identified  all 
external  interfaces  and  had  signed  interface  agreements  with  the  organizations 


*  Selective  retesting  to  detect  faults  introduced  during  modification  of  a  system 
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that  were  responsible  for  maintaining  systems  with  which  WPS  interfaced  The 
agreements  described  interface  configuration  management  and  program 
management  issues.  If  the  sending  or  receiving  system  made  any  changes  to  the 
interface,  each  system  manager  would  notify  the  other  as  soon  as  the  change  was 
determined.  During  testing,  interface  data  were  generated  and  passed  into  and  out 
of  the  WPS  in  a  simulated  environment  with  data  captured  and  analyzed. 

WPS  Y2K  Contingency  Plans.  The  WPS  Program  Management  Office 
developed  both  system  and  operational  contingency  plans  for  WPS  The  plans 
identified  Y2K  risk  contingencies  and  provided  preparatory,  execution,  and 
recovery  actions  to  minimize  the  affect  of  Y2K-related  disruption. 

Contingency  plans  included  the  probability  and  the  consequences  of  the  identified 
Y2K-related  risks  on  WPS.  The  plans  described  specific  actions  that  the 
functional  users,  the  operations  manager,  system  managers,  system  ■ 
administrators,  database  administrators,  and  help  desk  personnel  would  take  to 
minimize  potential  Y2K  interruptions  or  failures  of  WPS  operations. 

Certification  of  WPS.  WPS  was  certified  in  accordance  with  the  DoD 
Management  Plan  and  Army  Action  Plan  The  Commander,  MTMC  certified  the 
WPS  as  Y2K  compliant  on  November  5,  1998.  On  December  2,  1998,  the  Army 
Deputy  Chief  of  Staff  for  Logistics  (Director  of  Transportation,  Energy  and  Troop 
Support)  also  certified  the  WPS.  MTMC  and  the  Army  certified  WPS  to 

•  validate  the  effectiveness  of  Y2K  solutions, 

•  provide  a  consolidated  document  to  record  organizations  demonstrating 
due  diligence,  and 

•  provide  a  clear  and  complete  audit  trail. 

Those  purposes  were  adequately  supported  by  documented  test  plans  and  test 
reports,  compliance  checklists  and  matrixes  that  summarized  the  results  of 
compliance  assessments  and  tests,  interface  agreements,  and  contingency  plans 

Independent  Assessment.  MTMC  hired  Computer  Sciences  Corporation  to 
conduct  an  independent  assessment  of  the  WPS  certification  process  and 
documentation.  The  contractor  evaluated  the  certification  testing  procedures  and 
test  results  and  compared  the  test  strategy  to  the  critical  functions  of  WPS  to 
ensure  that  all  functions  were  appropriately  tested  The  Computer  Sciences 
Corporation  also  tested  for  the  adequacy  and  coverage  of  Y2K  technical  risks  It 
concluded  that  WPS  had  a  low  risk  for  Y2K  failure  and  that  the  WPS  met  the 
requirements  of  the  Army  Certification  Checklist 

Conclusion 

The  WPS  Program  Management  Office  complied  with  DoD  and  Army  guidance 
in  processing  the  WPS  Y2K  certification.  Specifically,  the  certification  of  WPS, 
the  development  of  contingency  plans,  and  the  independent  assessment  minimize 
the  risk  of  a  WPS  failure  associated  with  Y2K  processing  Therefore,  we  are 
making  no  recommendations  in  this  report 
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Appendix  A.  Audit  Process 


This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer,  DoD, 
to  monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a  list  of 
audit  projects  addressing  the  issue,  see  the  Y2K  webpage  on  the  IGnet  at 
http  ://www.  ignet .  gov/. 

Scope  and  Methodology 

We  reviewed  documented  efforts  that  Headquarters,  Department  of  the  Army,  the 
U.S.  Transportation  Command;  MTMC;  and  contractor  representatives  made  to 
ensure  that  Y2K  problems  would  not  disrupt  operations  of  WPS  We  obtained 
and  reviewed  the  DoD  Management  Plan  and  the  Army  Action  Plans  for  policy 
guidance  on  Y2K  program  management  and  reporting.  We  obtained  and  reviewed 
documentation  on  the  WPS  status,  interface  agreements,  test  plans,  test  reports, 
contingency  plans,  and  the  Army  certification  process.  We  reviewed  and 
analyzed  documents  dated  from  October  1997  through  April  1999  Also,  we 
interviewed  key  personnel  from  the  organizations  that  were  responsible  for 
management  of  the  WPS  to  determine  its  Y2K  status  We  used  the  information 
from  the  documents  and  interviews  to  assess  the  Y2K  compliance  status  of  the 
WPS.  Data  reviewed  were  current  as  of  April  1999 

DoD-Wide  Corporate  Level  Goals.  In  response  to  the  Government  Performance 
and  Results  Act,  DoD  established  6  DoD-wide  corporate-level  performance 
objectives  and  14  goals  for  meeting  the  objectives.  This  report  pertains  to 
achievement  of  the  following  objective  and  goal 

Objective:  Prepare  now  for  an  uncertain  future  Goal:  Pursue  a  focused 
modernization  effort  that  maintains  U.S.  qualitative  superiority  in  key  war 
fighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  of  the  following  objectives  and  goals  in  the 
Information  Technology  Management  Functional  Area 

Objective:  Become  a  mission  partner.  Goal:  Serve  mission  information 
users  as  customers  (ITM-1.2) 

Objective:  Provide  services  that  satisfy  customer  information  needs. 

Goal:  Modernize  and  integrate  DoD  information  infrastructure. 

(ITM-2.2) 

Objective:  Provide  services  that  satisfy  customer  information  needs 
Goal:  Upgrade  technology  base.  (ITM-2.3) 
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High-Risk  Area.  In  its  identification  of  high-risk  areas,  the  General  Accounting 
Office  has  specifically  designated  risk  in  resolution  of  the  Y2K  problem  as  high 
This  report  provides  coverage  of  that  problem  and  of  the  overall  Information 
Management  and  Technology  high-risk  area 

Use  of  Technical  Assistance.  A  computer  engineer  from  our  Technical 
Assessment  Division  assisted  in  analyzing  the  WPS  certification  test  plan  and  test 
results. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  from 
March  through  April  1999,  in  accordance  with  auditing  standards  issued  by  the 
Comptroller  General  of  the  United  States,  as  implemented  by  the  Inspector 
General,  DoD.  We  did  not  use  computer-processed  data  to  perform  this  audit 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD  Further  details  are  available  upon  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognized  the  Y2K 
issue  as  a  material  management  control  weakness  area  in  the  FY  1998  Annual 
Statement  of  Assurance 


Summary  of  Prior  Coverage 

The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have  conducted 
multiple  reviews  related  to  Y2K  issues  General  Accounting  Office  reports  can 
be  accessed  over  the  Internet  at  http,//www. gao.gov/  Inspector  General,  DoD, 
reports  can  be  accessed  over  the  Internet  at  http  //www  dodig  osd  mil/ 
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Appendix  B.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Deputy  Under  Secretary  of  Defense  (Logistics) 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Deputy  Chief  Information  Officer  and  Deputy  Assistant  Secretary  of  Defense  (Chief 
Information  Officer  Policy  and  Implementation) 

Principal  Director  for  Year  2000 
Assistant  Secretary  of  Defense  (Public  Affairs) 


Joint  Staff 

Director,  Joint  Staff 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Army 
Auditor  General,  Department  of  the  Army 
Inspector  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Chief  Information  Officer,  Navy 

Auditor  General,  Department  of  the  Navy 

Inspector  General,  Department  of  the  Navy 

Inspector  General,  Marine  Corps 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Air  Force 
Auditor  General,  Department  of  the  Air  Force 
Inspector  General,  Department  of  the  Air  Force 
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Unified  Commands 


Commander  in  Chief,  U.S.  European  Command 
Commander  in  Chief,  U.S.  Pacific  Command 
Commander  in  Chief,  U.S.  Central  Command 
Commander  in  Chief,  U.S.  Transportation  Command 
Commander,  Military  Traffic  Management  Command 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Sy  stems  Agency 
United  Kingdom  Liaison  Office,  Defense  Information  Systems  Agency 
Director,  Defense  Intelligence  Agency 

Inspector  General,  Defense  Intelligence  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Imagery  and  Mapping  Agency 

Inspector  General,  National  Imagery  and  Mapping  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
National  Security  Division  Special  Projects  Branch 
Federal  Chief  Information  Officers  Council 
General  Accounting  Office 

National  Security  and  International  Affairs  Division 
Technical  Information  Center 
Accounting  and  Information  Management  Division 

Director,  Defense  Information  and  Financial  Management  Systems 
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Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International  Relations, 
Committee  on  Government  Reform 
House  Subcommittee  on  Technology,  Committee  on  Science 
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